Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Database Security
Authentication
Mobile
Privacy
Compliance
Careers and People
Identity & Access Management
Security Monitoring
Advanced Threats
Insider Threats
Vulnerability Management
Comments
Top 5 Reasons Your Small Business Website is Under Attack
Newest First  |  Oldest First  |  Threaded View
<<   <   Page 2 / 3   >   >>
cherr552
cherr552,
 User Rank: Apprentice
8/27/2014 | 8:02:34 PM
How do non-techie small businesses get security advice?
Many small businesses have a web presence, but no tech expertise--their web sites are developed by designers or consultants, who rarely return to maintain what they've built. 



In the setup-and-forget model, the site builders make recommendations about the hosting provider, and they should be able to recommend a security provider as well.  After all, their reputation depends on building sites that perform well (for their customers--the small businesses).
Chris Weltzien
Chris Weltzien,
 User Rank: Author
8/27/2014 | 12:48:54 PM
Re: What about solutions? >Early Trends in Hosting
Exactly. The incremental premium for a hosting service that takes security seriously is negligible compared to the lost revenue/reputation if your company's website gets placed on the Google blacklist/blocklist.
Chris Weltzien
Chris Weltzien,
 User Rank: Author
8/27/2014 | 12:45:37 PM
Re: Don't bother without security
Unfortunately security is often the last thing to be addressed in a website launch plan (if it's addressed at all) and the more dynamic a site is, the greater the attack surface is likely to be. We're hoping to raise the awareness that big names make the big news (Target, etc) but the majority iof attacks target smaller businesses. The cost is also coming down so it should be attainable for almost all start-ups.
Chris Weltzien
Chris Weltzien,
 User Rank: Author
8/27/2014 | 12:38:08 PM
Re: Automation
I like the analogy. I may borrow that one. Thanks!
Chris Weltzien
Chris Weltzien,
 User Rank: Author
8/27/2014 | 12:37:11 PM
Re: What about solutions?
WAFs are a valuable layer in website security. Companies that don't have dedicated IT resources may want a "security suite" approach that includes vulnerability and malware scanning and remediation as well. On the DDoS side its not a particular concern for smaller businesses, the bigger threat for them is being hacked and co-opted into a botnet that will participate in the actual DDoS attack.
Whoopty
Whoopty,
 User Rank: Ninja
8/27/2014 | 12:17:52 PM
Don't bother without security
This is why I feel like I'm stomping on people's ideas everytime a friend tells me they've come up with a clever business idea that involves a website. If they don't know how to handle security themselves and can't afford to hire someone to do it for them, it seems doomed to fail. 

When your reputationo can be ruined so easly, it's going to become much harder to startup internet based businesses, without some serious capital funding to help shore up defenses, preemptively and after the fact. 
Biffster
Biffster,
 User Rank: Apprentice
8/27/2014 | 9:48:17 AM
Automation
Nice article.  What I like about the author's company 6Scan, is their emphasis on automation to improve website safety and security.  It is a complicated world out there.  Thanks for making it a little simpler.  Imagine how effective the air bags in your car would be if you had to operate them manually.  Automation is the key, especially for small business sites.
Stratustician
Stratustician,
 User Rank: Moderator
8/27/2014 | 9:38:51 AM
Re: What about solutions?
I'm surprised we don't see more small business solutions around Web Application Firewalls (WAF) or DDoS.  These are great ways to limit the risk of malicious traffic and can be offered as hosted solutions.
Marilyn Cohodas
Marilyn Cohodas,
 User Rank: Strategist
8/27/2014 | 7:05:13 AM
Re: What about solutions? >Early Trends in Hosting
I find it really interesting that web hosting companies are looking to offer 3rd party website security services tailored for the small biz market because of the increasing cost for them to repair hacked sites....  That's something to consider when choosing a web hosting vendor. 
Chris Weltzien
Chris Weltzien,
 User Rank: Author
8/27/2014 | 12:52:35 AM
Re: What about solutions?
Paul you point out a common misconception. Most hosting companies provide security only for the web server itself, not the websites that reside on the server. Often small business owners don't have the time or resources to drill down on this critical delineation. Fortunately, there is an early trend in the hosting space to offer 3rd party website security services tailored for this market (the cost for hosting companies to keep repairing hacked sites is becoming a significant burden). At 6Scan our automated service is an advanced low-touch solution designed for small businesses and there are a few other options including SiteLock and Sucuri.
<<   <   Page 2 / 3   >   >>


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The 10 Most Impactful Types of Vulnerabilities for Enterprises Today
Managing system vulnerabilities is one of the old est - and most frustrating - security challenges that enterprise defenders face. Every software application and hardware device ships with intrinsic flaws - flaws that, if critical enough, attackers can exploit from anywhere in the world. It's crucial that defenders take stock of what areas of the tech stack have the most emerging, and critical, vulnerabilities they must manage. It's not just zero day vulnerabilities. Consider that CISA's Known Exploited Vulnerabilities (KEV) catalog lists vulnerabilitlies in widely used applications that are "actively exploited," and most of them are flaws that were discovered several years ago and have been fixed. There are also emerging vulnerabilities in 5G networks, cloud infrastructure, Edge applications, and firmwares to consider.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2023-1142
PUBLISHED: 2023-03-27
In Delta Electronics InfraSuite Device Master versions prior to 1.0.5, an attacker could use URL decoding to retrieve system files, credentials, and bypass authentication resulting in privilege escalation.
CVE-2023-1143
PUBLISHED: 2023-03-27
In Delta Electronics InfraSuite Device Master versions prior to 1.0.5, an attacker could use Lua scripts, which could allow an attacker to remotely execute arbitrary code.
CVE-2023-1144
PUBLISHED: 2023-03-27
Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contains an improper access control vulnerability in which an attacker can use the Device-Gateway service and bypass authorization, which could result in privilege escalation.
CVE-2023-1145
PUBLISHED: 2023-03-27
Delta Electronics InfraSuite Device Master versions prior to 1.0.5 are affected by a deserialization vulnerability targeting the Device-DataCollect service, which could allow deserialization of requests prior to authentication, resulting in remote code execution.
CVE-2023-1655
PUBLISHED: 2023-03-27
Heap-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.4.0.